Subject: [Nicolas Williams] Re: GSSAPI naming and domain-based names

From: Sam Hartman <[email-masked]>
Date: Wed, 10 Sep 2003 16:33:43 -0400

Hi.  Over in the SASL working group we have been discussing the
problem of GSSAPI and naming for SASL mechanisms.  The problem is that
if you are using some protocol like LDAP that does SRV records, you
need to make sure that you authenticate both the name the user typed
in as well as the eventual hostname that you ended up using at the
GSSAPI layer.

Nico is going to work on a proposal that he will presumably submit as
a proposed standard.  At this time, this is not a work item of the
SASL working group, although we expect to discuss the issues on our
mailing lists.  Interested CAT fanciers may want to follow that
discussion.

Subject: Re: GSSAPI naming and domain-based names
From: Nicolas Williams <[email-masked]>
To: Sam Hartman <[email-masked]>
Cc: [email-masked]
Date: Wed, 10 Sep 2003 12:41:10 -0700

I will write two drafts: one about GSS-API domain-based names and one
about domain-based names for the Kerberos V GSS-API mechanism.

Cheers,

Nico

On Wed, Sep 10, 2003 at 03:06:45PM -0400, Sam Hartman wrote:
> So, several people spoke up in favor of looking at the GSSAPI name
> issue and no one seemed to object to looking at the problem.  
> 
> would you be interested in writing up an individual draft that defines
> the new GSSAPI name type for domain-based services?  I haven't talked
> to Kurt about whether he thinks this work is in scope, but even if it
> is, we'll want to see an individual draft first and later make it a
> working group document.
> 
> If you do write up an individual draft, I'd request that you have the
> draft announcement copied here and to [email-masked].